FinCEN issues final rule requiring investment advisers to maintain AML/CFT compliance programs
FinCEN’s Investment Adviser Rule will, as of January 1, 2026, require certain investment advisers to implement and maintain AML/CFT compliance programs and monitor for and report suspicious activity.
On August 28, 2024, the Financial Crimes Enforcement Network (FinCEN) of the U.S. Treasury Department issued a final rule that will, among other things, require certain registered investment advisers (RIAs) and exempt reporting advisers (ERAs) (together, covered investment advisers) to implement risk-based and reasonably designed anti-money laundering and countering the financing of terrorism (AML/CFT) compliance programs and file certain reports, including Suspicious Activity Reports (SARs), with FinCEN (the Investment Adviser Rule).[1] Covered investment advisers will be required to come into compliance with the rule by January 1, 2026.
The Investment Adviser Rule, in large part, adopts the requirements detailed in the proposed Investment Adviser Rule the (Proposed Rule);[2] however, FinCEN made several key revisions to the Proposed Rule in response to public comments. For example, the Investment Adviser Rule narrows the definition of covered investment adviser to exclude certain types of registered investment advisers; excludes from the scope of the rule certain activities of foreign-located investment advisers; and no longer requires that compliance with AML/CFT requirements must be the responsibility of, and performed by, persons in the United States.
Notably, as part of the AML/CFT compliance program requirement, the Investment Adviser Rule will apply two of the four core elements of customer due diligence (CDD) to covered investment advisers. Under the Investment Adviser Rule, covered investment advisers will be required to implement risk-based CDD procedures to (1) understand the nature and purpose of customer relationships to develop a customer risk profile; and (2) conduct ongoing monitoring to identify and report suspicious transactions and maintain and update customer information. FinCEN will address the remaining core elements of CDD in future rulemakings. For example, on May 21, 2024, FinCEN and the Securities and Exchange Commission (SEC) issued a joint rulemaking that would apply Customer Identification Program (CIP) requirements to covered investment advisers,[3] and the agencies are working towards finalizing the proposed CIP Rule. In addition, FinCEN will require covered investment advisers to comply with the beneficial owner identification and verification requirements of the CDD Rule when the agency revises the CDD Rule as mandated by the Corporate Transparency Act.[4]
Consistent with the Proposed Rule, FinCEN has delegated its examination authority to the SEC, which aligns with FinCEN’s existing delegation to the SEC of its authority to examine broker-dealers and mutual funds for compliance with the BSA and its implementing regulations. FinCEN also extended the compliance date of the Investment Adviser Rule, originally proposed to be one year from the publication date of the final rule, to January 1, 2026.
Key provisions of the Investment Adviser Rule
Overview of the rule
Investment advisers covered by the rule
The Investment Adviser Rule will add “investment advisers” to the definition of “financial institution” at 31 C.F.R. § 1010.100(t) and will define “investment advisers” as:
- Registered investment advisors, which are persons registered or required to be register with the SEC under section 203 of the Investment Advisers Act;[5] and
- Exempt reporting advisers, which are persons that are exempt from SEC registration under sections 203(l) or 203(m) of the Investment Advisers Act.[6]
A key change in the Investment Adviser Rule is the narrowing of the definition of “investment adviser” from the Proposed Rule. The term now excludes RIAs that register with the SEC solely because they are: (1) mid-sized advisers,[7] (2) multi-state advisers;[8] (3) pension consultants;[9] and (4) advisers that do not report any assets under management to the SEC on Form ADV.[10]
The Investment Adviser Rule maintains the phrase “foreign-located investment advisers” in the definition of “investment adviser,” which means the Investment Adviser Rule will apply to non-U.S. investment advisers that are physically located abroad (e.g., foreign investment advisers that do not have a branch, office or staff in the United States) and registered or required to register with the SEC or file a Form ADV with the Commission. However, the Investment Adviser Rule clarifies that its requirements will only apply to the advisory activities of foreign-located investment advisers that (1) take place within the United States, including through the involvement of U.S. personnel of the investment adviser; or (2) provide advisory services to a U.S. person or a foreign-located private fund with an investor that is a U.S. person.
Finally, the Investment Adviser Rule will not apply to state-registered investment advisers;[11] foreign private advisers;[12] or family offices.[13]
Key compliance requirements
AML/CFT compliance program
With respect to the AML/CFT compliance program requirements, the Investment Adviser Rule largely adopts the requirements detailed in the Proposed Rule. As a result, a covered investment adviser will be required to implement and maintain a risk-based AML/CFT compliance program that is approved in writing by the adviser’s board of directors (or sole proprietor, general partner, or trustee). In the Investment Adviser Rule, FinCEN reinforces that a risk-based approach to AML/CFT compliance means that a covered investment adviser may focus aspects of its AML/CFT compliance program on high-risk activities and/or customers and, likewise, may apply more limited measures to low-risk customers and/or activities. At a minimum, a covered investment adviser’s risk-based AML/CFT compliance program must include the following:
- Policies, procedures, and internal controls reasonably designed to prevent money laundering, terrorist financing, and other illicit finance activities;[14]
- Independent testing for compliance with the BSA and its implementing regulations, which must be conducted by a covered investment adviser’s personnel or a qualified outside party;[15]
- A designated person or persons that are responsible for implementing and monitoring the operations and internal controls of the AML/CFT compliance program;[16]
- Ongoing training for appropriate personnel;[17] and
- Ongoing CDD that includes: (a) understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and (ii) conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.[18]
Consistent with the Proposed Rule, the Investment Adviser Rule will exclude mutual funds from the requirements of a covered investment adviser’s AML/CFT compliance program requirements because mutual funds are already subject to the requirements of the BSA and its implementing regulations. Importantly, the Investment Adviser Rule clarifies that in excluding a mutual fund from its AML/CFT compliance program, a covered investment adviser is not obligated to verify that a mutual fund has implemented an AML/CFT compliance program. In addition, FinCEN expanded the exclusion from the AML/CFT compliance program to also apply to (1) bank- and trust company-sponsored collective investment funds that comply with the requirements of 12 C.F.R. § 9.18 or a similar applicable law that incorporates the requirements of 12 C.F.R. § 9.18;[19] and (2) any other investment adviser subject to the Investment Adviser Rule that is advised by the covered investment adviser.
As discussed above, the Investment Adviser Rule will not immediately require covered investment advisers to comply with the CIP Rule (i.e., procedures to verify the identity of customers), or the beneficial ownership requirements of the CDD Rule. However, FinCEN will extend customer and beneficial owner identification and verification requirements through separate rulemakings. FinCEN has already issued a proposed joint rulemaking with the SEC to impose CIP requirements on covered investment advisers and is currently processing the public comments and working towards finalizing the rule.[20] In addition, FinCEN has again confirmed that it will extend the beneficial ownership information collection and verification requirements on covered investment advisers when it revises the CDD Rule as mandated by the Corporate Transparency Act, but did not provide an anticipated timeline for when it will issue the revised CDD Rule.
Finally, we should note that the Investment Adviser Rule narrows the scope of its requirements with respect to the advisory activities of foreign-located investment advisers—the rule would only apply to activities that (i) take place within the United States, including through the involvement of U.S. personnel of the investment adviser; or (ii) provide advisory services to a U.S. person or a foreign-located private fund with an investor that is a U.S. person. Relatedly, in a departure from the Proposed Rule, FinCEN has removed the so-called “Duty Provision” and, as a result, will no longer require that AML/CFT compliance programs are the responsibility of, and be performed by, persons in the United States (who are accessible to, and subject to oversight and supervision by, FinCEN and a Federal functional regulator). FinCEN further clarifies that covered investment advisers will be permitted to delegate the implementation and operation of some or all aspects of their AML/CFT compliance programs (and other AML/CFT measures) to foreign-located service providers, including fund administrators. Notwithstanding, as with any delegation to a service provider (whether located in the United States or outside the United States), FinCEN states that the delegation must be subject to contractual agreements and a risk-based approach to oversight—the covered investment adviser must remain responsible for overall implementation and ensure that FinCEN and the SEC are able to obtain information and records relating to its AML/CFT compliance program.
Suspicious activity reporting
Under the Investment Adviser Rule, FinCEN will impose SAR-filing requirements that generally align with the requirements applicable to other financial institutions regulated under the BSA. Accordingly, covered investment advisers will be required to file SARs for any suspicious transactions that are conducted or attempted by, at, or through an investment adviser and involve or aggregate at least $5,000 in funds or other assets, as other financial institutions are. The SAR filing requirements are separate from, and will not relieve a covered investment adviser from compliance with any reporting responsibilities separately imposed by the SEC.
Other notable compliance requirements
In addition to the AML/CFT compliance program and SAR reporting requirements, the Investment Adviser Rule will require covered investment advisers to:
- Comply with the Travel Rule and related recordkeeping requirements;[21]
- File currency transaction reports (CTRs) for transactions in currency of more than $10,000 conducted during a single day;[22]
- Comply with special due diligence requirements related to correspondent accounts—redefined to include advisory relationships—for foreign financial institutions and private banking accounts;[23] and
- Comply with special measures imposed by Treasury under Section 311 of the USA PATRIOT Act.
Covered investment advisers will also be subject to FinCEN’s rules implementing the special information-sharing procedures to detect money laundering and terrorist activity in sections 314(a) and 314(b) of the USA PATRIOT Act.[24] As a result, covered investment advisers will be allowed to share certain information with government agencies, law enforcement and other financial institutions to assist such parties with deterring illicit finance activities.[25]
Looking ahead
While FinCEN extended the compliance date of the Investment Adviser Rule to January 1, 2026, without further guidance from FinCEN and the SEC, covered investment advisers may find it challenging to build an effective compliance program that meets the AML/CFT requirements established in the Investment Adviser Rule. In addition, covered investment advisers’ AML/CFT compliance programs will eventually be required to incorporate procedures to comply with the CIP and CDD Rules, which will only increase the resources covered investment advisers will need to allocate towards their existing compliance and risk management frameworks. Accordingly, given the evolving compliance environment, covered investment advisers should begin building their AML/CFT compliance programs as soon as possible and continue to monitor for any developments on the final CIP and CDD Rules.
[1] FinCEN, Press Release, FinCEN Issues Final Rules to Safeguard Residential Real Estate, Investment Adviser Sectors from Illicit Finance (August 28, 2024), https://www.fincen.gov/news/news-releases/fincen-issues-final-rules-safeguard-residential-real-estate-investment-adviser; FinCEN, Fact Sheet: FinCEN Issues Final Rule to Combat Illicit Finance and National Security Threats in the Investment Adviser Sector (August 28, 2024), https://www.fincen.gov/sites/default/files/shared/IAFinalRuleFactSheet-FINAL-508.pdf.
[2] We discuss the Proposed Investment Adviser Rule in detail in this client update.
[3] We discuss the Proposed Investment Adviser Customer Identification Program Rule in this client update.
[4] We discuss the Beneficial Ownership Information Reporting Rule and FinCEN’s plans to issue conforming amendments to the CDD Rule in this client update.
[5] 15 U.S.C. § 80b–3(a).
[6] 15 U.S.C. §§ 80b–3(l), (m). An ERA is generally an investment adviser that would be required to register with the SEC but is statutorily exempt from the registration requirement because (1) it is an adviser only to one or more venture capital funds; or (2) it is an adviser only to one or more private funds and has less than $150 million assets under management in the United States.
[7] Mid-size advisers are investment advisers that are not registered with a state securities regulator and have assets under management (AUM) between $25 million and $100 million. See 15 U.S.C. § 80b-3a(a)(2).
[8] Multi-state advisers are advisers that would otherwise be required to register in more than 15 states but who have less than $100 million in AUM and are allowed to register with the SEC. See 17 C.F.R. § 275.203A-2(d).
[9] A pension consultant provides investment advice to (i) any employee benefit plan described in section 3(3) of ERISA, (ii) any governmental plan described in section 3(32) of ERISA, or (iii) any church plan described in section 3(33) of ERISA (29 U.S.C. § 1002(33)). 17 C.F.R. § 275.203A-2(a)(2).
[10] These are RIAs who do not manage client assets as part of their advisory activities and report zero AUM on Form ADV. Services provided by these advisers may include non-discretionary financial planning (such as fee-only advice) and publication of securities-related newsletters, “model portfolios,” or research reports.
[11] State-registered investment advisers have AUM under $100 million and are prohibited from registering with the SEC. See 17 C.F.R. § 275.203A-1.
[12] See 15 U.S.C. § 80b–3(b)(3). The “foreign private adviser” exemption is available to an adviser that (i) has no place of business in the United States; (ii) has, in total, fewer than 15 clients in the United States and investors in the United States in private funds advised by the adviser; (iii) has aggregate assets under management attributable to such clients and investors of less than $25 million; and (iv) does not hold itself out generally to the public in the United States as an investment adviser. See 15 U.S.C. § 80b-2(a)(30).
[13] See 15 U.S.C. 80b-2(a)(11)(G). A “family office” is defined as a company that (i) has no clients other than family clients; (ii) is wholly owned by family clients; and (ii) does not hold itself out as an investment adviser. 17 C.F.R. § 275.202(a)(11)(G)-1.
[14] Similar to the Proposed Rule, FinCEN states in the Investment Adviser Rule that an investment adviser will be required to review and assess, among other things, the types of advisory services it provides, the nature of the customers it advises, its investment products, distribution channels, intermediaries it operates through and geographic locations of its customers and business activities.
[15] FinCEN states that any individual conducting independent testing, whether internal or external, must be independent of the function being tested in the covered investment adviser’s AML/CFT compliance program.
[16] FinCEN further states that for an AML/CFT compliance program to be appropriately risk-based and reasonably designed to achieve compliance with the BSA, the AML/CFT officer must be sufficiently qualified—and whether an individual is sufficiently qualified as an AML/CFT officer will depend, in part, on the covered investment adviser’s risk profile. In addition, FinCEN notes that a covered investment adviser must provide its AML/CFT officer with decision-making authority regarding the AML/CFT compliance program and sufficient stature within the firm to ensure that the compliance program meets the applicable requirements of the BSA and its implementing regulations.
[17] FinCEN confirms again in the Investment Adviser Rule that AML/CFT training can be conducted through outside or in-house seminars and include computer-based training. In addition, the nature, scope and frequency of the training program should be determined by the responsibilities of the relevant employees and the extent to which their functions include AML/CFT requirements and risks.
[18] FinCEN clarifies that covered investment advisers may, but are not required to, implement formal risk-rating models or methodologies to assist with their ongoing CDD obligations. FinCEN notes that covered investment advisers have discretion to apply risk factors appropriate for their business activities and products; however any approach should be informed by the covered investment adviser’s risk assessment for its advisory business and should be sufficiently detailed to distinguish between significant variations in the illicit finance risks of its customers. FinCEN states further that there are no required risk profile categories and the number and detail of these risk categories will vary based on the adviser’s size and complexity.
[19] Note, FinCEN clarified that it added the reference to “other applicable law that incorporates the requirements of 12 C.F.R. § 9.18,” to extend the exclusion to collective investment funds formed pursuant to state law or regulation, or other applicable law such as ERISA, as long as those other applicable laws incorporate the requirements of 12 C.F.R. § 9.18.
[20] See 31 U.S.C. § 5318(l); FinCEN, SEC, Customer Identification Programs for Registered Advisers and Exempt Reporting Advisers, 89 Fed. Reg. 44571 (May 21, 2024).
[21] The Investment Adviser Rule will require investment advisers to create and retain records for transmittals of funds of $3,000 or more and ensure that certain information “travels” with the transmittals to the next financial institution in the payment chain. The Recordkeeping Rule is codified at 31 C.F.R. § 1010.410(e). The Travel Rule is codified at 31 C.F.R. § 1010.410(f).
[22] Under the BSA and its implementing regulations, a wide range of persons, including investment advisers, are currently required to file reports for the receipt of more than $10,000 in currency and certain negotiable instruments using Form 8300. Under the Investment Adviser Rule, covered investment advisers will be required to file CTRs instead of filing reports using Form 8300. See 31 C.F.R. §§ 1010.311, 1010.313(b).
[23] Under the Investment Adviser Rule, covered investment advisers would be considered “covered financial institutions” for purposes of compliance with the special due diligence requirements related to correspondent accounts for foreign financial institutions and private banking account. See 31 C.F.R. §§ 1010.610 and 1010.620.
[24] See 31 C.F.R. §§ 1010.520, 1010.540. In practice, this would allow covered investment advisers to share certain information with government agencies, law enforcement and other financial institutions to assist such parties with deterring illicit finance activities.
[25] The Investment Adviser Rule clarifies that covered investment advisers may deem the applicable 314(a) and 314(b) requirements satisfied for any mutual funds, bank- and trust company-sponsored collective investment fund, or any other investment adviser they advise subject to the Investment Adviser Rule that is already subject to AML/CFT compliance program requirements.